An mvfst QUIC server vulnerability allows a remote unauthenticated client to cause unbounded memory growth by sending Handshake-level CRYPTO data after the TLS handshake has progressed past that encryption level. This can lead to denial of service. The issue affects mvfst versions prior to v2026.11.09.00.